Technical impact
A vulnerability in phpIPAM up to version 1.8.3 allows an attacker to inject malicious scripts by altering the REQUEST_URI argument of the upgrade/index.php file. The flaw is triggered by the unknown functionality of this endpoint and results in a reflected cross‑site scripting condition that can be exploited remotely. The malicious script execution occurs within the victim’s browser, enabling an attacker to steal session cookies, deface content, or perform man‑in‑the‑middle attacks, all without needing local access or authentication to the web interface.
Affected Systems
The affected product is phpIPAM, the open‑source network IP address management system. All releases up to and including 1.8.3 are vulnerable. No specific build or patch level beyond 1.8.3 is listed, so any deployment that has not upgraded past that release remains at risk.
Risk and Exploitability
The CVSS score of 4.8 indicates a moderate severity. The exploit is publicly disclosed, and the vulnerability can be triggered remotely by sending a crafted HTTP request to the upgrade/index.php endpoint, with the attacker needing only to control the input value of REQUEST_URI. The EPSS score is unavailable; it is not recorded in the CISA KEV catalog. Because the flaw does not require authentication, an unauthenticated attacker can perform the exploit, increasing the potential impact on exposed installations.
